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DETAILED ACTION 

Continued Examination Under 37 CFR 1. 1 14 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1 .17(e), was filed in this application after allowance or after an Office 
action under Ex Parte Quayle, 25 USPQ 74, 453 O.G. 213 (Comm'r Pat. 1935). Since 
this application is eligible for continued examination under 37 CFR 1.114, and the fee 
set forth in 37 CFR 1.17(e) has been timely paid, prosecution in this application has 
been reopened pursuant to 37 CFR 1.114. Applicant's submission filed on 5/26/201 1 
has been entered. 

Information Disclosure Statement 

2. The information disclosure statement filed 5/26/201 1 fails to comply with 37 CFR 
1 .98(a)(3) because it does not include a concise explanation of the relevance, as it is 
presently understood by the individual designated in 37 CFR 1 .56(c) most 
knowledgeable about the content of the information, of each patent, publication, or other 
information listed that is not in the English language. It has been placed in the 
application file, but the information referred to therein has not been considered. The 
Foreign Patent Documents and the Japanese Office Actions have been considered. 
However, the "Addressing Spam mail" article listed on the information disclosure 
statement has no English translation, and no statement is given of the relevance of this 
document. 
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Allowable Subject Matter 

3. The indicated allowability of claims 1 -20 is withdrawn in view of the newly 
discovered reference(s) to Milliken, Goodman and Knowles. Rejections based on the 
newly cited reference(s) follow. 

4. Claim 1 2 is objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the 
base claim and any intervening claims. 

Claim Objections 

5. Claims 1 1 -1 4 are objected to because of the following informalities: Claims 1 1 - 
1 4 depend from claim 1 0. Claim 1 0 was amended to a non-transitory computer- 
readable storage medium. Claims 1 1-14 disclose the computer-readable storage 
medium of claim 10. Claims 11-14 should be amended to add "non-transitory" for 
purposes of clarity and consistency with claim 10. Appropriate correction is required. 

Claim Rejections - 35 USC § 1 12 

6. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claims 1 , 2, 4-6, 1 0, and 1 4-1 6 are rejected under 35 U.S.C. 1 1 2, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 

8. Claims 1, 2, 4-6, 10, and 14-16 refer to URLs, but fail to define what the URL 
abbreviation stands for within the claims. Appropriate correction is required. 
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Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

1 0. Claims 1 -1 1 and 1 3-14 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Milliken et al. (US 2004/0073617) in view of Goodman et al. (US 
7,711,779). 

11. In regard to claim 1 , Goodman disclosed a method comprising: 

using one or more computer processors, extracting URLs from electronic 
communication; and (column 7, lines 56-63, identifying a spam message based upon 
the presence of a URL) 

analyzing the URLs extracted to determine whether the electronic communication 
is of a first predetermined category, (column 7, lines 56-63) 

Goodman disclosed extracting URLs from electronic communications. Goodman 
disclosed determining whether a email is spam based upon the presence or absence of 
a URL. Goodman failed to disclose the step of generating signatures or hash values 
based upon the content of the email message. 

However, Milliken disclosed generating signatures or hash values based upon 
the content of the email message (using a length of the electronic communication and 
the URLs extracted). Milliken, [0050], where one or more portions of a received email 
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are hashed to produce a hash value. Any portion of the main text, or attachments may 
be hashed. The hash acts as a signature in [0052]. 

It would have been obvious to one of ordinary skill in the art at the time of 
invention to incorporate the hashing of an email to determine whether the email 
constituted spam, into the Goodman system which used the presence or absence of 
URLs to determine whether an email constituted spam, in order to build a more robust 
spam prevention system. 

1 2. In regard to claim 2, Goodman disclosed the method of claim 1 , wherein 
extracting the URLs comprises extracting at least one of a hostname, a domain name, a 
subsection of a domain relative link, and an Internet Protocol (IP) address from the 
electronic communication. Goodman, col. 7, lines 58-63 and col. 13, lines 45-53. The 
elements of at least one of a hostname, a domain name, a subsection of a domain 
relative link, and an Internet Protocol (IP) address are inherently part of the URL as 
disclosed in Goodman 

1 3. In regard to claim 3, Milliken disclosed the method of claim 1 , further comprising 
performing a predetermined operation on the electronic communication if the electronic 
communication is determined to be of the first predetermined category. [0080], rejecting 
message if suspicion score is high enough 
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14. In regard to claim 4, Milliken disclosed the method of claim 1 , wherein analyzing 
the URLs comprises: 

selecting one or more of the one or more signatures generated; and [0054], 
storing of hash values 

comparing the selected signatures against a plurality of predetermined 
signatures generated from a plurality of known electronic communications of the first 
predetermined category. [0082], checking hashed portions of a message with known 
email lists which have been hashed 

1 5. In regard to claim 5, Milliken disclosed the method of claim 1 , wherein generating 
the one or more signatures further comprises: 

computing a first hash based on the length of the electronic communication; 
computing a second hash ...; and generating a signature by concatenating the first hash 
to the second hash. Milliken disclosed hashing portions of an email, [0050]. A fixed 
length of a hash is established in [0055]. Concatenating hashes is taught in [0086]. 

1 6. Milliken failed to disclose an extracted URL was hashed. 

1 7. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 1 3, lines 
45-53 
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1 8. It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

19. In regard to claim 6, Milliken disclosed the method of claim 4. Milliken, [0050], 
hashing one or more portions of a received email. Milliken failed to disclose an 
extracted URL was hashed. 

20. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 13, lines 
45-53 

21 . It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

22. In regard to claim 7, Milliken disclosed the method of claim 4, wherein generating 
the one or more signatures further comprises generating the one or more signatures 
based on at least one of a protocol, a hostname, a domain name, a subsection of a 
domain relative link, and an Internet Protocol (IP) address from the electronic 
communication. Milliken, [0096], hashing specific headers from an email separately, 
such as the use of Yahoo Groups 
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In regard to claim 8, Milliken disclosed the method of claim 4, further comprising 
classifying the electronic communication to be of the first predetermined category if one 
of the selected signatures matches one of the plurality of predetermined signatures. 
[0082], checking hashed portions of a message with known email lists which have been 
hashed 

23. In regard to claim 9, Milliken disclosed the method of claim 4, wherein the 
plurality of predetermined signatures is derived from a plurality of electronic documents 
reported via a collaborative submission mechanism. Milliken, [0061], preloading of 
hashes from "legitimate email list servers" 

24. In regard to claim 1 0, Milliken disclosed a non-transitory computer-readable 
storage medium that provides instructions that, if executed by a processor, will cause 
the processor to perform operations comprising: 

generating one or more signatures of electronic communication using a length of 
the electronic communication...; and Milliken, [0050], where one or more portions of a 
received email are hashed to produce a hash value. Any portion of the main text, or 
attachments may be hashed. The hash acts as a signature in [0052]. 

determining whether the electronic communication is of a first predetermined 
category using the one or more signatures generated. Milliken, [0082], checking 
hashed portions of a message with known email lists which have been hashed to 
determine if a message is spam or suspicious. 

Milliken failed to disclose hashing the URL extracted from a message. 
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25. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 1 3, lines 
45-53 

26. It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

27. In regard to claim 1 1 , Milliken disclosed the computer-readable storage medium 
of claim 10, wherein determining whether the electronic communication is of the first 
predetermined category comprises: 

selecting one or more of the one or more signatures generated based on a 
plurality of predetermined criteria; [0068], hash the main text of the body and [0070], 
hash the attachments of the email. Also see [0050]. The use of hash blocks in [0050] is 
selecting a signature generated based on a plurality of predetermined criteria. 

comparing the selected signatures against a plurality of predetermined 
signatures; and [0082], comparing hashes with previously received hashes 

classifying the electronic communication to be of the first predetermined category 
if one of the selected signatures matches one of the plurality of predetermined 
signatures. [0082] 

28. In regard to claim 1 3, Milliken disclosed the computer-readable storage medium 
of claim 1 1 , wherein selecting one or more of the one or more signatures generated 
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comprises selecting signatures representing one or more of a protocol, a hostname, a 
domain name, and a subsection of a domain relative link having a predetermined string 
of letters. Milliken, [0096], hashing specific headers from an email separately, such as 
the use of Yahoo Groups 

29. In regard to claim 14, Goodman disclosed the computer-readable storage 
medium of claim 10, wherein the operations further comprise extracting the URLs from 
the electronic communication, (column 7, lines 56-63, identifying a spam message 
based upon the presence of a URL) 

30. Claims 1 5-19 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
Milliken in view of Goodman in view of Knowles et al. (US 5,905,863). 

31 . In regard to claim 1 5, Milliken disclosed a system comprising: 

a server, coupled to the plurality of databases, including: server 120, [0035] 
a memory device to store a plurality of instructions; and 
a processor, coupled to the memory device, to retrieve the plurality of 

instructions from the memory device and to perform operations in response to 

the plurality of instructions, the operations comprising: 

generating one or more signatures of electronic communication 
using a length of the electronic communication...; and Milliken, [0050], 
where one or more portions of a received email are hashed to produce a 
hash value. Any portion of the main text, or attachments may be hashed. 
The hash acts as a signature in [0052]. 
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determining whether the electronic communication is of a first 
predetermined category using the one or more signatures generated. 
Milliken, [0082], checking hashed portions of a message with known email 
lists which have been hashed to determine if a message is spam or 
suspicious. 

Milliken failed to disclose hashing the URL extracted from a message. 

32. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 1 3, lines 
45-53 

33. It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

34. Milliken and Goodman failed to disclose a plurality of databases to store a 
plurality of signatures of a plurality of known electronic communications of a first 
predetermined category. Milliken did disclose comparing known signatures of email 
messages. Milliken failed to disclose the signatures compared were stored in a plurality 
of databases. 

35. However, Knowles did disclose use of multiple databases to compare message 
content to determine if a message was a reply to another message. Knowles, column 
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5, lines 2-4 disclosed the multiple databases of different content, and column 5, lines 
53-64 disclosed the querying of multiple databases of email content. 

36. It would have been obvious to one of ordinary skill in the art at the time of 
invention that Milliken's hash signatures would have been storable in a plurality of 
databases for purposes of data backups and storage of different types of data. 

37. In regard to claim 1 6, Goodman disclosed the system of claim 1 5, wherein the 
URLs comprises at least one of a hostname, a domain name, a subsection of a domain 
relative link, and an Internet Protocol (IP) address. Goodman, col. 7, lines 58-63 and 
col. 13, lines 45-53. The elements of at least one of a hostname, a domain name, a 
subsection of a domain relative link, and an Internet Protocol (IP) address are inherently 
part of the URL as disclosed in Goodman 

38. In regard to claim 1 7, Milliken disclosed the system of claim 1 5, wherein the 
operations further comprise selecting the one or more of the plurality of signatures 
based on a plurality of predetermined criteria. [0068], hash the main text of the body 
and [0070], hash the attachments of the email. Also see [0050]. The use of hash 
blocks in [0050] is selecting a signature generated based on a plurality of predetermined 
criteria. 

39. In regard to claim 18, Milliken disclosed the system of claim 15, wherein the 
operations further comprise performing a predetermined operation on the electronic 
communication if the electronic communication is determined to be of the first 
predetermined category. Milliken, [0082], checking hashed portions of a message with 
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known email lists which have been hashed to determine if a message is spam or 
suspicious. 

40. In regard to claim 1 9, Knowles disclosed the system of claim 1 5, further 
comprising a database, coupled to the server, to store a plurality of reports from which 
the plurality of predetermined signatures are generated. Knowles, col. 5, lines 55-58. 

41 . Claim 20 is rejected under 35 U.S.C. 103(a) as being unpatentable over Milliken 
in view of Goodman in view of Knowles as applied to claim 15 above, and further in 
view of Official Notice. 

42. In regard to claim 20, Milliken in view of Goodman in view of Knowles disclosed 
the system of claim 15. The combined references failed to disclose wherein the plurality 
of databases are in a remote location from the server. However, Official Notice is taken 
that databases were commonly stored in remote locations from a server at the time of 
invention to allow for remote storage of data and for emergency management 
procedures in case of catastrophic events. It would have been obvious to one of 
ordinary skill in the art at the time of invention to remotely store databases in the 
Milliken/Goodman/Knowles combination. 
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Conclusion 

43. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeffrey R. Swearingen whose telephone number is 
(571)272-3921 . The examiner can normally be reached on M-F 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on 571-272-3868. The fax phone number 
for the organization where this application or proceeding is assigned is 571 -273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Jeffrey R Swearingen 

Examiner 

Art Unit 2445 
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